caf9280c918c9caf768a031069328176487d6603702f32a49a76d1802cc08edf

Analysis

max time kernel
24s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 12:17

Target

caf9280c918c9caf768a031069328176487d6603702f32a49a76d1802cc08edf.exe
Size

32KB
MD5

d8165e80958867fae0f7f85463d412fc
SHA1

52ca387e3f92154bb9aea9d8db7a2754a703bfda
SHA256

caf9280c918c9caf768a031069328176487d6603702f32a49a76d1802cc08edf
SHA512

5ef89ad2abf68fd01f3293c9622b3a23c109774778dfb8de9fc7f33089d9042c0f397354bb2b20428a1005f8748dd5ffbe330cf36b64c6cd6f62fdf4dd3b0476
SSDEEP

384:5NYOuQrUDESDA82DErgMkBnrk2dgYVbTzoBRaZCt9BO2M+J1f4mn:LYHYUDSGrgtxrkmn1ABQYrD1jn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1736	1340	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1736	1340	caf9280c918c9caf768a031069328176487d6603702f32a49a76d1802cc08edf.exe	28
PID 1340 wrote to memory of 1736	1340	caf9280c918c9caf768a031069328176487d6603702f32a49a76d1802cc08edf.exe	28
PID 1340 wrote to memory of 1736	1340	caf9280c918c9caf768a031069328176487d6603702f32a49a76d1802cc08edf.exe	28
PID 1340 wrote to memory of 1736	1340	caf9280c918c9caf768a031069328176487d6603702f32a49a76d1802cc08edf.exe	28

C:\Users\Admin\AppData\Local\Temp\caf9280c918c9caf768a031069328176487d6603702f32a49a76d1802cc08edf.exe
"C:\Users\Admin\AppData\Local\Temp\caf9280c918c9caf768a031069328176487d6603702f32a49a76d1802cc08edf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 88
  2⤵
  - Program crash
  PID:1736

memory/1340-54-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download